User Guide

Configuring User Encryption 201
Nortel WLAN Security Switch 2300 Series Configuration Guide
Client Support
To use the TKIP or CCMP cipher suite for encryption, a client must support WPA. However, an AP radio configured for
WPA can support non-WPA clients who use dynamic WEP or static WEP. If the WPA IE is enabled in the service
profile used by an SSID supported by the radio, and the 40-bit WEP or 104-bit WEP cipher suite also is enabled in the
service profile, WSS Software allows a non-WPA client to authenticate using WEP under the following circumstances:
• If a client wants to authenticate using dynamic WEP, WSS Software uses 802.1X to authenticate the client if either
the WEP40 or WEP104 cipher suite is enabled for WPA.
• If a client wants to authenticate using static WEP, the radio checks for the static WEP key presented by the client. If
the keys match, WSS Software authenticates the client. Because the WEP key is static, WSS Software does not use
802.1X to authenticate the client.
To allow a non-WPA client that uses dynamic WEP to be authenticated by a radio on which WPA IE is enabled, enable
the WEP40 or WEP104 cipher suite in the service profile for the SSID the client will access. To prevent non-WPA
clients that use dynamic WEP from being authenticated, do not enable the WEP40 or WEP104 cipher suite in the service
profile.
To allow a client that uses static WEP to be authenticated, configure the same WEP keys on the client and the service
profile.